| Legislative： |
Promulgated by the FIA of the Ministry of Finance Zi Di No.1080002139 on July 19, 2019. |
| Content： |
1. Purpose
To enhance information security, all county and city revenue services must adhere to appropriate controls for duplicating tax database for business needs.
2. Scope of application
Applicable to all county and city revenue services of the reengineering project of local tax system that uses the Utility System (JUT), database tools and On-site Work Management System (YST) to replicate tax database data management operations.
3. Definition
(1) Inspector
Personnel who are skilled and professional in business, responsible for inspection, control, collection and storage, and perform inspection operations independently.
(2) Application system personnel
Personnel who are responsible for maintaining the reengineering project of local tax system application system.
(3) Database data replication manager
Personnel who accept and keep tax database data copying and management application forms.
4. Database data replication management
(1) Data copying application process
A. Before performing a database data copy operation, in addition to applying for system function use permissions according to regulations (JUT, database tools, and YST), the user of YST performing copying operations should use the system electronic form to
apply online for survey or download permissions.
When conducting copying operations by other methods, a “Tax Database Data Duplicate Management Application Form” should be filled in separately in duplicate according to the purpose (see example in Attachment 1). Each agency may add or revise the application
form shown in Attachment 1 to suit their needs.
B. For routine work, when applying for the first time, the execution frequency should be indicated in the “Operation Cycle” field of the application form. A separate application form should be submitted each time in the case of temporary work. In cases of
data download, the scheduled completion date of the assignment should be filled in.
After the application is approved by the director of the unit, a copy is kept by the applicant. The other copy is submitted to the database data copy management personnel for filing for future reference, to facilitate follow-up data deletion control and audit
use; if the “Tax Database Data Duplicate Management Application Form” is made electronically and the electronic signature is completed, the electronic data of the form should be stored in its entirety in the application system.
(2) Application system personnel can use the following three procedures to
perform duplication jobs; it is recommended to use JUT and YST first:
A. Use the Utility System (JUT) for database data export operation
a. The database data export operation should be run through the Utility System (JUT) performed by the Operation Management Automation System (YCM).
b. The inspector should use the Utility System to produce the previous month’s “Database Export (JUT1F1X) List” (Attachment 2) and “Database Export (JUT1F1X) Statistics Sheet” (Attachment 6) at the beginning of each month, send it to the application system
personnel to confirm the relevant use records, and the inspector will report the “Database Export (JUT1F1X) Statistics Sheet” to the director of the unit. Before the fifteenth day of every month, the approval statistics sheet shall be transmitted to the relevant
business contractors of the FIA.
B. Access the database by using the database tools
a. Access data using database tools, the application number (or job purpose)
should be stated in the SQL syntax remarks each time it is executed, to
facilitate follow-up audits.
b. The inspector should use the Audit Management System (YMS) to produce the previous month’s “Database Access History List” (Attachment 3) and “Database Access History Statistics Sheet” (Attachment 7) at the beginning of each month, then send it to the application
system personnel to confirm the relevant use records, and the inspector will submit the “Database Access History Statistics Sheet” to the director of the unit. Before the fifteenth day of every month, the approval statistics sheet shall be submitted to the
relevant business contractors of the FIA.
C. Use the On-site Work Management System (YST) to query and download
The inspector should make an “On-site Work (YST) Investigation Record Form” (Attachment 4), “On-site Work (YST) Application and Actual Download Record Form” (Attachment 5), and “On-site Work (YST) Database Inquiry and Download Times Statistics Sheet” (Attachment
8) at the beginning of each month, and send it to the application system personnel to confirm the relevant use records. The inspector will submit the “On-site Work (YST) Database Inquiry and Download Times Statistics Sheet” to the director of the unit. Before
the fifteenth day of every month, the approval statistics sheet shall be submitted to the relevant business contractors of the FIA.
5. Database data copy, save, and delete operations
(1) All agencies should fulfill their data preservation and management responsibilities.
(2) Application system personnel should work with database data replication management personnel, delete the relevant data within one month after the end of the scheduled completion date of the job, the application system personnel should fill in the date of
data deletion in the original “Tax Database Data Duplicate Management Application Form” (Example: Attachment 1), and the application system personnel and the database data copy management personnel both verify the data deletion. After the report is approved
by the supervisor of the unit by the applicant, the report is submitted to the database data duplication management personnel and the original case is filed for future reference (those who use YST to perform copying operations should use the system electronic
form to perform data deletion control operations online).
6. Database data copy audit operation
(1) Internal check
A. When inspectors conduct random checks each month, a ratio of at least 2%, and not less than ten records, of each database data copy procedure should be randomly inspected (if the total number of records is less than ten, all should be checked). If the total
number of records exceeds one thousand, the inspection ratio for the number of records exceeding one thousand is reduced to 5‰. The results should be submitted to the unit supervisor for approval, and kept for five years for auditing.
B. Inspectors that use the Utility System (JUT), Audit Management System (YMS), and On-site Work Management System (YST) to produce separate “Database Export Checklists” (Attachment 9), “Database Access History Checklist” (Attachment 10), and “On-site Work
(YST) Database Checklist and Download Times Checklist” (Attachment 11) on a monthly basis, should check whether the application system personnel database data copy operation conforms to the application purpose and cycle.
(2) Internal audit
Each agency shall form an internal audit team to handle audit work; the audit team should be composed of the government ethics unit (or the audit unit designated by the head) and related units, perform internal audits at least once every six months, and make
audit records based on audit results.
If any defect is found, improvements should be made immediately, and the relevant records should be kept for five years for future reference.
(3) External audit
The external audit is handled by the FIA when each agency handles the “assessment of county and city revenue services tax collection business.” All agencies should cooperate in providing relevant information (such as inventory, statistical sheets, audit records,
etc.).
(4) Handling of abnormalities and defects
If there are any abnormal events or defects in the inspection results, improvements should be made immediately; if there is a violation of relevant laws, regulations, or this management operation manual, the reason should be immediately identified with the
audit (the government ethics) unit, and the report will be submitted to the head of the agency and the FIA. |